CVE-2026-114594Sandisk Sandisk Dashboard
NVD
Vulnerability Summary
A time-of-check to time-of-use (TOCTOU) race condition in the Sandisk Dashboard installer allows a local, authenticated standard user to replace an installer-staged binary in a user-writable temporary directory between validation and execution. The elevated installer then executes the attacker-controlled binary, resulting in local privilege escalation to a high-integrity (administrative) context. This issue affects Sandisk Dashboard through 5.2.2.3.
CVSS v4.0 Base Metrics — Score 5.4 (MEDIUM)
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:NAttack VectorLocal
Attack ComplexityLow
Attack RequirementsPresent
Privileges RequiredLow
User InteractionActive
Confidentiality (Vulnerable System)High
Integrity (Vulnerable System)High
Availability (Vulnerable System)High
Confidentiality (Subsequent System)None
Integrity (Subsequent System)None
Availability (Subsequent System)None
Affected & Patched Versions
- Sandisk Sandisk Dashboard <= 5.2.2.3
- Sandisk Sandisk Dashboard 5.2.2.3
What to do
Fix it during your normal patch cycle. No exploitation is confirmed yet.
- Check whether you run Sandisk Sandisk Dashboard and which version.
- Update to a patched version listed above, then confirm the new version.
Timeline
- Nov 9, 2026Published
- Nov 12, 2026Record last modified
Score, severity and exploitation changes are tracked from the day Watchtower started logging them.
Get notified about new Sandisk Sandisk Dashboard CVEsYou are reading CVE-2026-114594. Get an email when KEV listings, exploits or new CVEs match your stack.
Set up CVE alertsExternal References
Data last checked: Nov 13, 2026 18:08 UTC